The present invention relates to methods and devices for enforcing network access control (NAC) utilizing secure packet tagging.
In recent years, security has become an increasing concern in information systems. This issue has become more significant with the advent of the Internet and the ubiquitous use of network environments (e.g. LAN and WAN). An important area of IT security is ensuring that only authorized and well-secured machines are allowed access into a local network. This area is known as Network Access Control or NAC.
Methods for tagging packets, outside of the realm of NAC, have primarily enabled endpoints to authenticate themselves to IPS (intrusion prevention system) devices during penetration testing. Such methods only tag for endpoint-to-IPS traffic, as opposed to tagging all traffic (e.g. endpoint-to-gateway, gateway-to-endpoint, and endpoint-to-endpoint). Such prior-art tagging methods are global (i.e. there is no identification of the endpoints), and do not solve problems that arise from packet fragmentation.
It would be desirable to have methods and devices for enforcing NAC utilizing secure packet tagging. Such methods and devices would, among other things, overcome the limitations of the prior art as described above by tagging between an endpoint and a gateway (or between two secure endpoints), providing the properties of traffic authentication and integrity protection.